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Attorney Docket No. RSW920040084US1-10 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re application of: James E. Aston et al. 



Confirmation # 4476 



Application No. 10/710,477 



Examiner: Mahesh H. Dwivedi 



Filed 



July 14, 2004 



Group Art Unit: 2168 



Title: METHOD AND SYSTEM TO ) 
PROTECT A FILE SYSTEM FROM ) 
VIRAL INFECTIONS ) 

Mail Stop AF 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

REMARKS IN SUPPORT OF PRE-APPEAL BRIEF REQUEST FOR REVIEW 

Applicants submit that the current and preceding office actions issued by the 
Examiner in the present application contain clear errors in the Examiner's rejections as well 
as omissions of one or more essential elements needed for a prima facie rejection under 35 
U.S.C. § 102 and/or 35 U.S.C. § 103. 

The present invention is related to protecting a file system from a viral infection. A 
program running on a computer is flagged as being suspect for possibly containing a virus in 
response to the program performing at least one of a set of predetermined file system 
operations. The file system operations include: opening a local file on a local file system of 
the computer to perform a read operation and opening a shared file on a shared or network 
file system to perform a write or append operation with the local file; the program reading or 
opening itself and the program attempting to write or append any content to the shared file on 
the shared or network file system or to write or append any content to the local file on the 
local file system; the program attempting to write or append the local file to the shared or 
network file system and preserve a filename of the local file in the shared or network file 
system; and the program attempting to write or append a remote file to the local file system. 
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A filename and a location where the local or shared file is copied or written is stored in 
response to the local or shared file being copied or written by the program. 

Claims 1-2, 5, 7-9, 12-19, 21-30, 32-38, and 40-44 were rejected under 35 U.S.C. § 
102(b) as being unanticipated by Halperin, et al. (U.S. Pub. 2002/0194490). For the reasons 
discussed herein, applicant respectfully respects that Halperin fails to teach the essential 
elements needed for a prima facie rejection under 35 U.S.C. § 102. Claim 1 recites: 
"Flagging a program on a computer as being suspect for possibly containing a virus in 
response to at least one of: opening a local file on a local file system of the computer to 
perform a read operation and opening a shared file on a shared or network file system to 
perform a write or amend operation with the local file; the program reading or opening itself 
and the program attempting to write or append any content to the shared file on the shared or 
network file system or to write or append any content to the local file on the local file system; 
the program attempting to write or append the local file to the shared or network file system 
and preserve a file name of the local file in the shared or network file system; and the 
program attempting to write or append a remote file to the local file system . . ." 

The Final Office Action dated as mailed November 16, 2007, cited the abstract of 
Halperin in rejecting the feature of flagging a program on a computer as being suspect for 
possibly containing a virus in response to at least one of the listed specific file system 
operations. The abstract of Halperin recites: "A method for malicious software detection 
including grouping a plurality of computing devices in a network into at least two groups, 
measuring a normal operation value of at least one operating parameter of any of the groups 
and detecting a change in value to indicate possible malicious software behavior within the 
network." 

Accordingly, Halperin does not teach or suggest flagging a program on a computer as 
being suspect for possibly containing a virus, nor does Halperin teach or suggest the specific 
conditions associated with the computer or file system operations as a condition for flagging 
the program on the computer as provided by Claim 1 . 

The Final Office Action also cited paragraphs [0097] -[01 07] in rejecting the specific 
file system operations as recited above in Claim 1. As recited in the Office Action, 
paragraph [0097] beginning at line 6 and continuing through paragraph [0107], Halperin 
recites: "Note download the pertinent paragraphs from the Batten Publication from the U.S. 
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P.T.O. database. [Insert P.T.O. database] 

Accordingly, Halperin teaches collecting information regarding target behavior 
detected at two or more computers 500 by the server 502. Then the server 502 correlates the 
presence of the target behavior to determine whether the correlated target behavior 
corresponds to a pre-defined suspicious behavior as an indication that a computer virus may 
have infected those computers. Applicant respectfully submits that there is not teaching or 
suggestion Halperin of flagging a program on an individual computer as being suspect for 
possibly containing a virus. Additionally, as indicated by the recitation from Halperin above, 
paragraphs [0098] - [0107] provide examples of expressions of suspicious behavior patterns. 
Applicant respectfully submits that none of the suspicious behavior patterns taught by 
Halperin teach or suggest the specific conditions or file system operations recited in Claim 1 
for flagging the program on the individual computer. 

Additionally, Claim 1 recites: "Storing a file name and a location where the local or 
shared file is copied or written in response to the local or shared file being copied or written 
by the program." The Office Action cited paragraph [0108] of Halperin for rejecting this 
feature of Claim 1. Paragraph [0108] of Halperin recites: "(insert paragraph [0108]] from 
Halperin on the U.S.P.T.O. database)" 

Accordingly, applicant respectfully submits that Halperin teaches away from the 
present invention in that Halperin quarantines the messages and docs not allow them to reach 
their intended destinations. In contrast, the present invention, as recited in the embodiment 
of Claim 1, permits the file to be copied or written by the program at its intended location 
and then stores the file name and location where the local or shared file is copied or written. 
In contrast, Halperin teaches storing an entire message, not merely a name or identification 
of the message, in a buffer associated with the server. The message is not allowed to be sent 
to its intended destination. Accordingly, there is no need for Halperin to store a file name 
and a location where the file is copied or written, and Halperin does not teach or suggest 
such as provided by the embodiment of the present invention as recited in Claim 1 . 

For all of the reasons discussed above, the applicant respectfully submits that claim 1 
is patentably distinguishable over Halperin, and reconsideration and withdrawal of the 35 
U.S.C. § 102 Rejection of Claim 1 is respectfully requested. 

Claims 2, 5, 7 and 8 depend directly from independent Claim 1. Because of this 
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dependency, Claims 2, 5, 7 and 8 contain all of the features of independent Claim 1. 
Therefore, these claims are also respectfully submitted to be patentably distinguishable over 
Halperin, in reconsideration and withdrawal of the § 102 rejection of these claims is 
respectfully solicited. 

With respect to the rejection of independent Claim 9 under 35 U.S.C. § 102(b) as 
being anticipated by Halperin, Claim 9 recites: "Logging any predetermined file system 
operations associated with the program including recording a file name and location where a 
file is written in response to the file being written." The Office Action cited paragraph 
[0108] in rejecting this feature of Claim 9. As previously discussed, Halperin teaches in 
paragraph [0108] quarantining at a server messages believed to contain a virus. In contrast, 
the present invention as recited in Claim 9 permits the file to be written and then records the 
file name and the location where the file is written. As discussed above, Halperin does not 
teach or suggest this feature of the present invention. Therefore, Claim 9 is respectfully 
submitted to be patentably distinguishable over Halperin, in reconsideration and withdrawal 
of the 35 U.S.C. § 102 rejection of Claim 9 is respectfully requested. 

With respect to the rejection of Claims 12-19 under 35 U.S.C. § 102(b) as being 
anticipated by Halperin, these claims recite additional features which further patentably 
distinguish over Halperin. For example, Claim 15 recites "Flagging a program in response to 
different file system operations similar to those recited in Independent Claim 1." As 
discussed with respect to Independent Claim 1, Halperin does not teach or suggest the 
specific file system operations recited in Dependent Claim 15. 

Additionally, Claims 12-19 depend either directly or indirectly from Independent 
Claim 9, and by virtue of that dependency, contain all of the features of Independent Claim 9. 
Therefore, Claims 12-19 are also submitted to be patentably distinguishable over Halperin, 
and reconsideration and withdrawal of the Section 102 Rejection of Claims 12-19 is 
respectfully solicited. 

Claims 3-4, 10-11, and 20 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Halperin as applied to Independent Claims 1 and 9 and in view of 
Satterlee, et al, (U.S. Patent Pub. No. 2004/0025015). Claims 3 and 4 depend directly from 
Independent Claim 1 and Claims 10-11 and 20 depend either directly or indirectly from the 
Independent Claim 9. Because of these dependencies, these dependent claims include all of 
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the features of the referenced independent claims. Applicant respectfully submits that 
Satterlee does not teach or suggest the features of Independent Claims 1 and 9 as previously 
discussed which also distinguish Claims 1 and 9 over Halperin. Therefore, Claims 3-4, 10- 
12 and 20 are respectfully submitted to be patentably distinguishable over Halperin and 
Satterlee, and reconsideration and withdrawal of the 35 U.S.C. § 103 rejection of these 
claims is respectfully solicited. 

As the Examiner's rejections have been shown to be in clear error and lack essential 
elements of a prima facie obviousness rejection, Applicants respectfully request that the 
claims of the present application be allowed to issue. 



Respectfully submitted, 



Date: .fte 




By: 



Charles L. Moore 
Registration No. 33,742 
Attorney for Applicants 
Moore & Van Allen, PLLC 
P.O. Box 13706 

Research Triangle Park, NC 27709 
Telephone: (919)286-8000 
Facsimile: (919) 286-8199 
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